 (defn assert-no-autosign [whitelist subject]
   (testing subject
     (is (false? (autosign-csr? whitelist subject empty-stream [])))))
-
-(defmethod assert-expr 'thrown-with-slingshot? [msg form]
-  (let [expected (nth form 1)
-        body     (nthnext form 2)]
-    `(sling/try+
-      ~@body
-      (do-report {:type :fail :message ~msg :expected ~expected :actual nil})
-      (catch map? actual#
-        (do-report {:type (if (= actual# ~expected) :pass :fail)
-                    :message ~msg
-                    :expected ~expected
-                    :actual actual#})
-        actual#))))
 
 (defn contains-ext?
   "Does the provided extension list contain an extensions with the given OID."

          (testing "CSR will not be saved when"
            (doseq [[policy subject csr-file expected]
                    [["subject-hostname mismatch" "foo" "hostwithaltnames.pem"
                      {:kind :hostname-mismatch
                       :msg "Instance name \"hostwithaltnames\" does not match requested key \"foo\""}]
                     ["subject contains invalid characters" "super/bad" "bad-subject-name-1.pem"
                      {:kind :invalid-subject-name
                       :msg "Subject contains unprintable or non-ASCII characters"}]
                     ["subject contains wildcard character" "foo*bar" "bad-subject-name-wildcard.pem"
                      {:kind :invalid-subject-name
                       :msg "Subject contains a wildcard, which is not allowed: foo*bar"}]]]
              (testing policy
                (let [path (path-to-cert-request (:csrdir settings) subject)
                      csr  (io/input-stream (test-pem-file csr-file))]
                  (is (false? (fs/exists? path)))
                  (is (thrown-with-slingshot? expected (process-csr-submission! subject csr settings)))
                  (is (false? (fs/exists? path)))))))

          (testing "CSR will be saved when"
            (doseq [[policy subject csr-file expected]
                    [["subject alt name extension exists" "hostwithaltnames" "hostwithaltnames.pem"
                      {:kind :disallowed-extension
                       :msg (str "CSR 'hostwithaltnames' contains subject alternative names "
                                     "(DNS:altname1, DNS:altname2, DNS:altname3), which are disallowed. "
                                     "Use `puppet cert --allow-dns-alt-names sign hostwithaltnames` to sign this request.")}]
                     ["unknown extension exists" "meow" "meow-bad-extension.pem"
                      {:kind :disallowed-extension
                       :msg "Found extensions that are not permitted: 1.9.9.9.9.9.9"}]
                     ["public-private key mismatch" "luke.madstop.com" "luke.madstop.com-bad-public-key.pem"
                      {:kind :invalid-signature
                       :msg "CSR contains a public key that does not correspond to the signing key"}]]]
              (testing policy
                (let [path (path-to-cert-request (:csrdir settings) subject)
                      csr  (io/input-stream (test-pem-file csr-file))]
                  (is (false? (fs/exists? path)))
                  (is (thrown-with-slingshot? expected (process-csr-submission! subject csr settings)))
                  (is (true? (fs/exists? path)))
                  (fs/delete path)))))))


          (testing "subject policies are checked"
            (doseq [[policy subject csr-file exception]
                    [["subject-hostname mismatch" "foo" "hostwithaltnames.pem"
                      #(= {:kind :hostname-mismatch
                           :msg "Instance name \"hostwithaltnames\" does not match requested key \"foo\""}
                          (select-keys % [:kind :msg]))]
                     ["invalid characters in name" "super/bad" "bad-subject-name-1.pem"
                      #(= {:kind :invalid-subject-name
                           :msg "Subject contains unprintable or non-ASCII characters"}
                          (select-keys % [:kind :msg]))]
                     ["wildcard in name" "foo*bar" "bad-subject-name-wildcard.pem"
                      #(= {:kind :invalid-subject-name
                           :msg "Subject contains a wildcard, which is not allowed: foo*bar"}
                          (select-keys % [:kind :msg]))]]]
              (testing policy
                (let [path (path-to-cert-request (:csrdir settings) subject)
                      csr  (io/input-stream (test-pem-file csr-file))]
                  (is (false? (fs/exists? path)))
                  (is (thrown+? exception (process-csr-submission! subject csr settings)))
                  (is (false? (fs/exists? path)))))))

          (testing "extension & key policies are not checked"
